{"data":{"id":"58060581-ae48-49a0-a60b-d031c86f16e2","title":"CVE-2025-36730: A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to x","summary":"CVE-2025-36730 describes a prompt injection vulnerability in Windsurft version 1.10.7 when used in Write mode with the SWE-1 model. An attacker can create a file name that is appended to the user prompt, causing Windsurf to follow instructions embedded in that name. Tenable Network Security, Inc. is the CNA, rating it CVSS 4.0 MEDIUM (4.6), and NIST has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-36730","publishedAt":"2025-10-14T17:15:39.623Z","cveId":"CVE-2025-36730","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Windsurf","SWE-1"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Windsurf prompt injection via crafted file name in Write mode","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00189,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-6mh4-fc28-667v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:36.761Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}